hxxps://myinvesco[.]com

Analysis

user interaction
yes
max time kernel
24s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://myinvesco.com
Sample260804-tvfscade93

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303341651833205"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{3153FE1C-C109-4646-ACFD-FC1E30270203}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1272	3040	msedge.exe	86
PID 3040 wrote to memory of 460	3040	msedge.exe	87
PID 3040 wrote to memory of 2792	3040	msedge.exe	88
PID 3040 wrote to memory of 2792	3040	msedge.exe	88
PID 3040 wrote to memory of 2792	3040	msedge.exe	88
PID 3040 wrote to memory of 1992	3040	msedge.exe	89
PID 3040 wrote to memory of 1992	3040	msedge.exe	89
PID 3040 wrote to memory of 4496	3040	msedge.exe	90
PID 3040 wrote to memory of 4496	3040	msedge.exe	90
PID 3040 wrote to memory of 2608	3040	msedge.exe	91
PID 3040 wrote to memory of 4496	3040	msedge.exe	90
PID 3040 wrote to memory of 2608	3040	msedge.exe	91
PID 3040 wrote to memory of 2608	3040	msedge.exe	91
PID 3040 wrote to memory of 4556	3040	msedge.exe	93
PID 3040 wrote to memory of 3504	3040	msedge.exe	94
PID 3040 wrote to memory of 4556	3040	msedge.exe	93
PID 3040 wrote to memory of 4556	3040	msedge.exe	93
PID 3040 wrote to memory of 3504	3040	msedge.exe	94
PID 3040 wrote to memory of 3504	3040	msedge.exe	94
PID 3040 wrote to memory of 3892	3040	msedge.exe	97
PID 3040 wrote to memory of 3892	3040	msedge.exe	97
PID 3040 wrote to memory of 3892	3040	msedge.exe	97
PID 3040 wrote to memory of 3832	3040	msedge.exe	99
PID 3040 wrote to memory of 3832	3040	msedge.exe	99
PID 3040 wrote to memory of 3832	3040	msedge.exe	99
PID 3040 wrote to memory of 3980	3040	msedge.exe	100
PID 3040 wrote to memory of 5024	3040	msedge.exe	101
PID 3040 wrote to memory of 3980	3040	msedge.exe	100
PID 3040 wrote to memory of 5024	3040	msedge.exe	101
PID 3040 wrote to memory of 5072	3040	msedge.exe	105
PID 3040 wrote to memory of 4688	3040	msedge.exe	110
PID 3040 wrote to memory of 4688	3040	msedge.exe	110
PID 3040 wrote to memory of 4688	3040	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://myinvesco.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb20eec188,0x7ffb20eec194,0x7ffb20eec1a0
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,12531236986898196389,1336310516014920582,524288 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1581777453303367063,12395243204655969926,262144 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,15385130054869204278,1887949567394470220,524288 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9654239756530718190,1268313704288611546,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8404163002296727181,14282318409099670085,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15390744441505748966,16998195883541438386,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11672153775040592214,12514407952146148742,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,884689072363809843,11708195217346793689,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3480,i,8015357561393344379,2845847519064189327,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4359659268372314681,12694126362596085375,524288 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,11720903395302916511,12636506379599633347,524288 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17109488504736730398,2893552913375763157,524288 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17109488504736730398,2893552913375763157,524288 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6392,i,6110777978870717134,9082242262850265526,2097152 --field-trial-handle=2252,i,2560149643427524862,10490962054492333245,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17a73b0b32466b970027638305274f552e3f58924b1fbf814dcfdfed13ab8a70
MD5 dfdd00bafce2b88cb7f689403b2536a0
SHA1 66a6b437148c43648f29db7846c4a1184f64bfa5
SHA512 935ef69970409007d05f29025428538959787ad4e10f752638c54776d7ef1534c389b3db3f4c9a913fba60f5e71d8f645a3f491028a6f347b9081b5696eae4ab
TLSH
T1F68162370282A6C0D3A4273990D68224367082DBFF6F5F7D3B9459F12B767150E19DD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585f32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585f32.TMP
Size 3KB
SHA256 c969bc69e22b55b7e484e813be068053e949ffc7363cb8b322c692c5c340993e
MD5 8a7ea6464c5ff83f33268467f72f1f0a
SHA1 39b7a50d9c49229e89899917a181eb6052d09d98
SHA512 82138be122915579863d35c7befe0070160419d433f5e7807d9ea2eaf73221758ecf0277fcb3b02099a839e6ae9bb7a52baf1ccd0c41f43fc5c1627e156b06c5
TLSH
T14A8161370282A6C0D3A4273990E68224367082EBFF6F5F7D3B9459F12B767250E19DC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93d6dc6b-61e1-425a-8158-be884f664cc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\93d6dc6b-61e1-425a-8158-be884f664cc0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 699f82379924154e51d731a6cf28415086df693ae5e447b147a3f3b448db445f
MD5 a4c1bb15fb67c05cfceeaf6390e875fe
SHA1 754ed3ed9ef33719f72957c9a3eef328390fbe04
SHA512 1309f80e26645df92d36496bc5a29c7c5171ce0c2ff672863c45c134d20135bef5b06c178439b159fad20c767c01303434f4e267e683a5f4626883da5c8f6954
SSDEEP 192:sxZRReyM/jK1Ml8Mk2/fosurPIdpTsHW6+WNGYCky4HTIgrJ:sxZRMM2/fosurgAHbG0L9
TLSH
T10B42FA11AA386977CCCBD309FA51BF53D6F91533A2900D58A9FCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1a5eca649d8dd2f22d8874019f71b2e613a9604e8b1a3fc06847ca4627c130b6
MD5 904ec87623ee6bb3c645cede0b8b3927
SHA1 1b9d4b54bbb0327816f7b8e1aaf0d19d70062dff
SHA512 5f7b1970de681a423a63906af80198bf8d08d88e3d5d74e6074fbcd6b9e9209564d0e5b23ed5e1f67bcd8c8d3ad48e26dab3cacb788bc7db46ffa19e92253cab
SSDEEP 768:LRa8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVRCros:LRa8bqn+WvSCt6u1jaCZLbWVRZs
TLSH
T13BD2FA3B280CCB7E4F845E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ecaf89e47482aecdf7165dde278055dd2502dc2ae58a56d33240d1c675516f16
MD5 65a93807f98307be1fb74b79af21306f
SHA1 523661f77a4363b5ff9a12575797654f5422c535
SHA512 6366fad6737b1f79186aaa4c92c2649130f212825210e51b22ee9cc0b1648511a6f6292d238553b91ee454b845ff80fecef84f64c21bddde655551d533e60b65
SSDEEP 48:KoXIpK0g0bypQIHKpOXwI/K92c7yfa/Q0CkQzPg9CI4szKpqBOzVqj+lYZ:KoX6K0gCKQoKpOXwgK92SWXOKo4g
TLSH
T104B1E102303F124638BE2528A3A6963BCD41B2573915ACFE7B7920618D6AE514DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85dc72f900fd2a0d533af69b5c2a1bd32d8398aedac5d48be9af624cd9c77288
MD5 e2ac4b72fa24a70dabb608a48147ebc0
SHA1 d631f9d244627d44a6a70db064ed7fd870055f84
SHA512 39040349c4c9aae8fe616e6aa2934ca5f379afa7da297c66e37276c6ee45ac796a62f9e7968785d27e87289a105ec88b261771ae1520bc5754b67c55043ea787
SSDEEP 192:vON3p6Db6QmiUyvXHBa+j2+FdCrtm5Rg/SJWU6:vON56u6HBa+ld85iWU6
TLSH
T13702D935687C6CBB9EB2AE49F4873B179FD4207BDA962B84DAD81F0C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48ae70a02c6e12c6a301aab8bce34b6485151bf4e2931abdddce6185b9a809b5
MD5 914653a38acacfd92541b36a63b9e51a
SHA1 ba8d99a7475fbc7755332eb0b369fbad2e467d73
SHA512 647df244b4492ed5945fd3d841f4ba05ef05bcd51fedb297c8c5748585242d4286ed79a96e726fc57da7435c877d86addff42ff9a2ccd1f0e585cfe7ec8831d3
SSDEEP 192:yONS6DbpQmiUybAXkBa+j2+FdCrtmEpe4GJNz/eq3cVU6:yONS6fLkBa+ld8aDcVU6
TLSH
T1B0121A3668786C7B5EE2A555F48736135EE49127DE8E7F90E6DC1F0C00DBA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 84c433ac2462c28aeffdb560acad79c91e6aac5aa253f80f9a810359b9d5909d
MD5 246d7b5cc540755d200731f2cab53e83
SHA1 c5a304cf91f00c86a44fa88343be94bdcc4830a0
SHA512 a8f15e6b1b0c364e927f0c5e716ce913ccda663272c4f616eaedbaf7ef20f90803d5eeb50f55f8f9eb8e9c5cff63b711dd02e3f082ec3096dd252aa2747a8c5c
SSDEEP 384:oZcIhsNPTiQeskEa+ld8wDcVBeRs9JKgqijUshOGF:WhPafa8fDoTjKgqmUshOGF
TLSH
T1DC928D3198386D7799E6B545F48B3A035FF49077DAC92F94A2ECAF0C00D69DC131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 966d3b35fb76b57c7cf034387729b19a413a82eada4ca97a75cdca3047942395
MD5 fb2a1d3795d39af0397f31fd8fadf274
SHA1 85fb3f6e64ade142cb4af35cbce4c2e3bcbb816d
SHA512 33837986b1b953ccfe9a0a742df63d5a354cc935724b6679d09d0fd63dd88233e27af1f1f234f8b0dee0ee141011650a760f44ddded27e95d61405e76e337772
TLSH
T12C41F85CB6FA1148B3B36F1A5BF6B86D447F79332E0AD49D10110D4E0A62A40DD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads